TL;DR: IGA platforms for SOC 2 and ISO 27001 automate access reviews, least-privilege enforcement, JML workflows, and audit evidence. Opti is best for AI-native entitlement intelligence and remediation, SailPoint for complex enterprise programs, Okta Identity Governance for Okta-centric teams, and Microsoft Entra ID Governance for Microsoft environments.

What Are IGA Platforms and How Do They Support SOC2 and ISO 27001 Compliance? 

Identity Governance and Administration (IGA) platforms are security solutions that help organizations manage, monitor, and control access to applications, systems, and sensitive data across human, non-human (NHI), and AI agent identities. These include employees, contractors, service accounts, machine identities, workload identities, and autonomous AI agents. IGA platforms provide centralized visibility into identities and their permissions, helping organizations ensure that every identity has appropriate access.

IGA platforms automate key identity lifecycle processes, including provisioning and deprovisioning, access requests, access reviews, and certification campaigns. They help enforce least-privilege access, detect excessive permissions, identify segregation of duties (SoD) violations, and remove unnecessary entitlements.

IGA platforms also play an important role in regulatory compliance and audit readiness across human and non-human identities. They help organizations demonstrate that access is appropriately authorized, regularly reviewed, and promptly revoked when no longer needed. For frameworks such as SOC 2 and ISO 27001, IGA platforms support access control requirements by maintaining audit trails, documenting approval workflows, enforcing access policies, and generating evidence for compliance assessments. 

SOC 2 controls supported by IGA platforms:

• CC6.1: Logical access security and identity management: Centralize identity visibility, govern entitlements, and coordinate access policies across connected systems.

• CC6.2: User registration and access provisioning: Automate approved onboarding and offboarding workflows while recording access approvals, provisioning, and removal.

• CC6.3: Role-based access, authorization, and access removal: Align permissions with business needs, enforce least privilege and segregation of duties, and remediate unjustified access.

• CC6.6–CC6.8: Supporting logical access and security controls: Govern sensitive permissions and revoke unauthorized access, complementing network, data protection, and endpoint security tools.

• CC7: Supporting security monitoring and risk detection: Detect identity risks and unusual access patterns, trigger remediation, and share governance events with security monitoring systems.

ISO 27001:2022 controls supported by IGA platforms:

• Annex A.5.15: Access control policies: Translate access policies into approval workflows, role-based permissions, and policy violation remediation.

• Annex A.5.16: Identity management: Automate identity lifecycle processes, maintain identity inventories, and identify orphaned or unmanaged accounts.

• Annex A.5.17: Authentication information management: Govern account authorization and credential-related approvals through integrations with identity providers, PAM, and other credential management tools.

• Annex A.5.18: Access rights and periodic reviews: Support evidence-driven reviews using access usage, business justification, entitlement risk, and segregation of duties analysis.

• Annex A.8.2: Privileged access rights: Identify elevated permissions, require approvals, and review privileged access, with PAM integrations supporting additional enforcement controls.

• Annex A.8.3: Information access restriction: Identify unnecessary access to sensitive resources and coordinate permission changes, with restrictions enforced by connected systems.

• Annex A.8.15: Logging and audit trails: Record access requests, approvals, changes, reviews, and revocations, complementing broader logging, retention, and security monitoring controls.

IGA Platforms for SOC 2 and ISO 27001 at a Glance

The table below summarizes the key differences between the IGA platforms covered in this guide. We explore each platform in more detail in the sections that follow.

Why Identity Governance Is Essential for SOC 2 and ISO 27001 Compliance 

Identity governance and administration (IGA) helps organizations manage access to business systems and demonstrate effective access controls for SOC 2 and ISO 27001 compliance. By centralizing access policies, lifecycle processes, and audit evidence, IGA supports consistent governance and reduces manual effort.

• Enforcing least-privilege access: IGA platforms align permissions with business needs, identify excessive or unused privileges, and adjust access as responsibilities change. This helps organizations restrict access to what users need.

• Demonstrating accountability for access decisions: Centralized records document who requested, approved, and received access. Periodic access reviews help managers and application owners confirm that permissions remain appropriate and decisions follow documented policies.

• Preventing unauthorized access and privilege accumulation: Automated provisioning and deprovisioning help prevent orphaned accounts and privilege creep. Policy checks can identify separation-of-duties conflicts and trigger remediation when access violates established requirements.

• Maintaining continuous audit readiness: IGA platforms retain access records, review results, approvals, and remediation evidence. These records help organizations demonstrate control operation during SOC 2 examinations and support ISO 27001 audits.

SOC 2 Controls Supported by Identity Governance Platforms 

SOC 2's Trust Services Criteria, established by the American Institute of Certified Public Accountants (AICPA), include requirements for logical access controls, identity management, authorization, and security monitoring.

CC6.1: Logical Access Security and Identity Management

CC6.1 focuses on implementing logical access security measures to protect information assets from unauthorized access and meet the organization's security objectives. This includes identifying and authenticating users, restricting access to sensitive resources, and managing access credentials. Organizations must establish controls that ensure only authorized identities can access protected systems, applications, and data.

IGA platforms support CC6.1 by providing centralized visibility into identities and their entitlements across business applications, cloud environments, and other connected systems. They help organizations establish access policies, identify excessive privileges, and coordinate access restrictions based on business roles and security requirements. Integrations with identity providers and authentication systems also help organizations apply consistent identity management policies across their environments.

CC6.2: User Registration and Access Provisioning

CC6.2 addresses the registration and authorization of users before system credentials are issued and access is granted. It also requires organizations to remove credentials when access is no longer authorized. Effective implementation requires documented procedures for onboarding users, approving access requests, periodically reviewing credentials, and revoking access when users leave the organization.

IGA platforms automate these processes through identity lifecycle workflows integrated with HR systems, identity providers, and business applications. When an employee joins, the platform can initiate provisioning workflows based on their role and approved access requirements. When an employee leaves, it can trigger deprovisioning workflows to remove unnecessary access. Centralized approval records and provisioning logs provide evidence that access was granted and removed according to established policies.

CC6.3: Role-Based Access, Authorization, and Access Removal

CC6.3 requires organizations to authorize, modify, and remove access to protected information assets based on roles, responsibilities, and system requirements. It specifically considers the principles of least privilege and segregation of duties (SoD). Access should be granted based on demonstrated business need rather than broad default or birthright entitlements. Permissions beyond an approved baseline should be treated as justified, time-bound exceptions requiring authorization, rather than privileges automatically assigned to everyone in a particular department or role.

IGA platforms support CC6.3 through role-based access control (RBAC), entitlement management, automated access reviews, and SoD policy enforcement. Integrating with a Human Resources Information System (HRIS) as the authoritative source for employee roles, departments, and employment status enables organizations to provision access based on verified identity attributes and maintain evidence linking each assignment to its business justification.

Advanced IGA platforms continuously evaluate entitlements to identify access that exceeds role requirements, conflicts with SoD policies, or is no longer used. Identity analytics can distinguish legitimate role-based access from unnecessary privileges and identify exceptions that require review. Automated remediation workflows can revoke unjustified permissions, enforce expiration dates for temporary access, and preserve evidence of authorization decisions and access removal for SOC 2 audits.

CC6.6–CC6.8: Supporting Logical Access and Security Controls

CC6.6 through CC6.8 address broader security requirements beyond traditional identity administration. CC6.6 focuses on protecting systems against threats originating outside system boundaries, CC6.7 addresses restrictions on the transmission, movement, and removal of information, and CC6.8 concerns preventing or detecting and responding to unauthorized or malicious software.

IGA platforms support these criteria indirectly by strengthening the identity and authorization controls that complement network security, data loss prevention (DLP), and endpoint protection technologies. For example, an IGA platform can identify which users have permissions to export sensitive information, manage privileged access assignments, and revoke permissions associated with suspicious or unauthorized activity. However, IGA platforms do not replace the dedicated security technologies needed to address these criteria fully.

CC7: Supporting Security Monitoring and Risk Detection

The CC7 series addresses system operations, including detecting security events, monitoring systems for anomalies, evaluating potential incidents, and responding to identified threats. Effective security monitoring requires organizations to identify unusual activity, investigate potential security incidents, and take appropriate corrective action. IGA platforms contribute to these objectives by continuously evaluating identity-related risks, including excessive permissions, unauthorized entitlement changes, orphaned accounts, and access policy violations across human and non-human identities.

Advanced IGA platforms use AI-driven identity analytics to identify risks that traditional periodic access reviews may overlook. These capabilities include:

• Peer-group access analytics: Compare an identity's permissions against users with similar roles, departments, or responsibilities to identify outlier access that may indicate excessive privileges or inappropriate authorization.

• Anomaly detection in access usage: Analyze entitlement usage patterns to identify unusual activity, such as rarely used privileged permissions becoming active, unexpected access changes, or AI agents accessing resources outside their established operational patterns.

• Automated high-risk entitlement classification: Identify and categorize sensitive permissions based on factors such as administrative capabilities, access to critical systems, exposure of sensitive data, and potential privilege escalation paths.

• Continuous identity risk evaluation: Reassess access risk as permissions, identity attributes, and usage patterns change, rather than relying exclusively on scheduled certification campaigns.

• Automated risk remediation: Trigger access revocation, entitlement adjustments, or approval workflows when excessive permissions, policy violations, or high-risk access combinations are detected.

These capabilities help organizations demonstrate how continuous identity risk detection contributes to SOC 2's CC7 monitoring and incident evaluation objectives. By connecting peer-group analytics, usage anomaly detection, and high-risk entitlement classification to actionable remediation workflows, IGA platforms can reduce the time between identifying inappropriate access and correcting it.

ISO 27001:2022 Controls Supported by IGA Platforms 

ISO/IEC 27001:2022 establishes requirements for an information security management system (ISMS), with Annex A providing a reference set of security controls that organizations can select based on their risk assessments. Several controls directly address identity management, access governance, privileged permissions, and auditability.

Annex A.5.15: Access Control Policies

Annex A.5.15 requires organizations to establish and implement rules governing physical and logical access to information and associated assets based on business and security requirements. Organizations must define who can access specific resources, under what conditions access is permitted, and how these rules are applied. Effective access control policies help prevent unauthorized access and ensure permissions align with business responsibilities.

IGA platforms support this control by centralizing access policies and translating them into workflows for requesting, approving, and managing permissions. They can use role-based access control (RBAC), attribute-based policies, and contextual information to determine appropriate access. Advanced platforms can also detect policy violations, identify excessive permissions, and initiate remediation workflows, helping organizations maintain consistent access governance across connected applications.

Annex A.5.16: Identity Management

Annex A.5.16 addresses the management of identities throughout their entire lifecycle, from initial creation to modification and eventual removal. Organizations need processes for maintaining accurate identity records, assigning appropriate ownership, and managing identity changes as users join, move within, or leave the organization. Incomplete identity lifecycle management can result in orphaned accounts, duplicate identities, and unauthorized access.

IGA platforms automate identity lifecycle management by integrating with HR systems, identity providers, directories, and business applications. They can create identities when employees join, adjust permissions when responsibilities change, and revoke access when employment ends. They also provide visibility into human and non-human identities, helping organizations identify unmanaged accounts and maintain accurate identity inventories across their environments.

Annex A.5.17: Authentication Information Management

Annex A.5.17 focuses on controlling the allocation and management of authentication information, including passwords, credentials, and other authentication secrets. Organizations must establish processes for handling authentication information securely and provide users with appropriate guidance on protecting their credentials. Weak credential management increases the likelihood of unauthorized access and identity compromise.

IGA platforms support this control by governing who is authorized to receive credentials and access authentication-enabled systems. Through integrations with identity providers, directories, and privileged access management (PAM) solutions, they can coordinate account creation, credential-related approvals, and account deactivation. However, capabilities such as password protection, secret rotation, multifactor authentication, and secure credential storage typically depend on dedicated IAM, PAM, or secrets management technologies.

Annex A.5.18: Access Rights and Periodic Reviews

Annex A.5.18 requires organizations to provision, review, modify, and remove access rights according to established access control policies. Access permissions must remain appropriate throughout the identity lifecycle, including when employees change roles, service accounts are no longer needed, or AI agents no longer require access to specific resources. 

Organizations need to demonstrate that access reviews are conducted regularly and that decisions are supported by meaningful evidence. Completing an access certification campaign alone does not establish that permissions remain appropriate. Effective reviews should consider actual access usage, business justification, and potential segregation of duties (SoD) conflicts rather than simply confirming existing entitlement assignments.

IGA platforms directly support this control through automated access certification campaigns, entitlement analysis, continuous access monitoring, and policy-based remediation:

• Access usage telemetry: Shows when permissions were last used, how frequently they are exercised, and whether assigned entitlements are actively needed. This helps reviewers identify dormant access and unnecessary privileges.

• Segregation of duties (SoD) analysis: Detects toxic combinations of permissions, such as the ability to create and approve the same financial transaction, including conflicts spanning multiple applications.

• Risk-based entitlement classification: Highlights privileged, sensitive, and high-risk permissions that require closer examination during access reviews.

• Peer-group access comparisons: Identifies permissions that differ significantly from those held by users with similar roles and responsibilities, helping reviewers detect excessive or unjustified access.

• Identity ownership and business context: Connects permissions to verified roles, business requirements, and accountable owners, including for non-human and AI agent identities.

Annex A.8.2: Privileged Access Rights

Annex A.8.2 addresses the allocation and use of privileged access rights, requiring organizations to restrict and manage elevated permissions. Privileged accounts can modify critical configurations, access sensitive information, and perform administrative operations, making them particularly attractive targets for attackers. Organizations must ensure that privileged access is granted only when justified and remains limited to authorized individuals.

IGA platforms help organizations discover privileged entitlements, identify excessive administrative permissions, and enforce approval workflows for elevated access. They can support periodic privileged access reviews, detect conflicting permissions, and identify users whose administrative rights are inconsistent with their responsibilities. 

Integration with PAM solutions enables additional controls such as just-in-time privilege elevation, session monitoring, and credential management, while IGA provides governance over who should receive privileged access.

Annex A.8.3: Information Access Restriction

Annex A.8.3 requires organizations to restrict access to information and associated assets in accordance with established access control policies. These restrictions should reflect the sensitivity of the information, business requirements, and the permissions necessary for users to perform their responsibilities. Without appropriate restrictions, users may gain access to confidential data or critical systems beyond what their roles require.

IGA platforms support information access restrictions by providing visibility into entitlements across connected applications, databases, cloud services, and other resources. They help organizations identify users with unnecessary access to sensitive information and initiate changes to align permissions with least-privilege policies. Identity analytics and access usage data can further support decisions about which permissions should be retained or removed. Actual enforcement of these restrictions generally occurs within the connected applications and authorization systems.

Annex A.8.15: Logging and Audit Trails

Annex A.8.15 requires organizations to produce, store, protect, and analyze logs of relevant activities, exceptions, faults, and other events. Reliable logging supports security investigations, accountability, and the detection of unauthorized activities. Organizations must maintain appropriate records and ensure that logging mechanisms provide sufficient information to investigate security-related events.

IGA platforms contribute to this control by maintaining records of identity governance activities, including access requests, approvals, provisioning changes, entitlement modifications, certification decisions, and access revocations. These records help organizations reconstruct access decisions, investigate unauthorized permission changes, and demonstrate that governance processes were followed.

IGA platforms can also integrate with SIEM and other monitoring solutions to make identity governance events available for broader security analysis. While IGA audit trails provide valuable evidence of access management activities, organizations still need appropriate system-level logging, log protection, retention, and monitoring controls to address Annex A.8.15 comprehensively.

Key Capabilities to Look for in IGA Platforms for SOC 2 and ISO 27001 

An effective IGA platform helps organizations govern access across their IT environment and maintain evidence for SOC 2 and ISO 27001 audits. Look for capabilities that combine identity visibility, automated workflows, continuous risk assessment, and auditable controls across human and non-human identities:

• Unified visibility into identities, roles, and entitlements: Centralize identity and access data across HR systems, identity providers, applications, and infrastructure. Relationship mapping should help teams identify excessive permissions, orphaned accounts, and unauthorized access paths.

• Automated user access reviews and certifications: Support scheduled and event-triggered reviews, risk-based prioritization, reviewer assignments, and remediation tracking. Preserve review decisions, supporting evidence, and confirmation of completed access changes.

• Continuous access risk analysis and recommendations: Use peer-group comparisons, anomaly detection, entitlement classification, and dynamic risk scoring to identify inappropriate access. Provide explainable remediation recommendations linked to approval and remediation workflows.

• Continuous least-privilege enforcement: Monitor entitlement changes, permission usage, and privilege accumulation to identify access that exceeds current business needs. Recommend or automatically remove unnecessary permissions under predefined, approved conditions.

• Automated joiner, mover, and leaver workflows: Integrate with authoritative identity sources to trigger provisioning, access changes, and deprovisioning. Identify orphaned accounts, track incomplete removals, and retain evidence of lifecycle actions.

• Policy-based access provisioning and deprovisioning: Apply role-based and attribute-based policies consistently across access requests, approvals, and entitlement changes. Support access expiration and policy-driven removal, with documented decisions and verified outcomes.

• Natural-language access policies and automated enforcement: Translate plain-language requirements into structured access rules. Require policy previews, interpretation explanations, validation, version histories, and audit trails before enabling automated enforcement.

• Separation of duties policy management: Detect conflicting permissions during access requests and across existing entitlements, including cross-application conflicts. Support remediation workflows and documented exceptions with compensating controls and expiration dates.

• Governance for non-human identities and AI agents: Discover identities, assign accountable owners, review permissions, monitor privileges, and verify deprovisioning. Preserve approval and lifecycle evidence, distinguishing permissions assigned directly to AI agents from those delegated by users.
  
  
  

Notable IGA Platforms for Enforcing SOC 2 and ISO 27001 Controls

How we selected these platforms: We shortlisted IGA platforms based on their support for access reviews and certifications, identity lifecycle automation, least-privilege and SoD enforcement, and the audit evidence needed for SOC 2 and ISO 27001 access controls.

AI-Native Identity Governance Platforms

1. Opti

Best for: Enterprises automating least privilege and audit evidence with AI

Strengths: Entitlement intelligence, AI remediation, continuous audit evidence

Things to consider: Newer vendor with limited independent user reviews so far

Opti is an AI-native identity security platform that ingests, normalizes, and analyzes human, non-human, and agentic identities across connected applications. Its entitlement models evaluate roles, policies, peer usage, and business context to detect risky or excessive access, and its workflow engine builds remediation plans and automated policies.

Opti can run alongside an existing IdP and IGA or as a standalone governance layer, with 250+ integrations and support for homegrown applications. For SOC 2 and ISO 27001 programs, it continuously maps identity, access, and entitlement data to roles, policies, and usage, and keeps an audit trail of every decision, change, and access mapping.

Key features include:

• Access graph with business context: Builds a living access graph of identities, entitlements, and usage across systems. A natural language interface answers questions such as who has admin access to SAP, and entitlements can be changed directly from the graph.

• Risk-scoped access reviews: Filters low-risk and policy-aligned access out of campaigns so reviewers focus on outliers, high-risk roles, and exceptions. Reviewers see last access, peer comparisons, and risk indicators, and can approve or revoke with one click.

• Plain-English policies: Teams define access rules, SoD constraints, and regulatory requirements in plain English, such as restricting production access to engineers. Opti scans continuously for violations and applies these rules to role suggestions.

• Automated remediation with human oversight: Revokes stale entitlements, removes excess privileges, and resolves orphaned accounts through guided remediation paths, with human approval kept for critical changes.

• AI-assisted lifecycle management: Suggests least-privilege access for joiners based on role, team, and peer behavior, recalibrates entitlements for movers, and revokes access at offboarding. Access requests arrive pre-scored with policy, peer usage, and SoD impact.

• Adaptive role mining: Connects to Okta or Entra ID and maps the organization’s actual role structure from identity data, then proposes role updates as people move. Users whose access exceeds their peer role are flagged against a maintained baseline.

• Just-in-time access: Grants elevated privileges on request and approval, and expires them when tasks are complete, so no standing access remains.

• Non-human identity and AI agent governance: Discovers and right-sizes service accounts, API keys, cloud workloads, vault secrets, and AI agents across IaaS, SaaS, PaaS, and on-prem, and shows what each AI agent can read, write, or manage.

Limitations (based on publicly available sources):

• Newer vendor: Opti emerged from stealth in late 2025, so independent user reviews on public review platforms are still limited.

• Enterprise focus: The platform is primarily deployed in large enterprises, so smaller teams should confirm packaging and onboarding fit.

• Phased connector coverage: Role mining starts from IdP data, and application-level entitlement analysis expands as additional connectors are added.

Request a demo of Opti identity security

2. Veza (from ServiceNow)

Best for: Enterprises governing effective permissions across many systems

Strengths: Access Graph, risk-based reviews, broad integration coverage

Things to consider: Now part of ServiceNow; setup and cost can be high

Veza is an identity security platform built around the Veza Access Graph, which maps users, non-human identities, AI agents, groups, roles, policies, permissions, and resources to show who can take which action on which data. ServiceNow completed its acquisition of Veza in March 2026 and is incorporating Veza’s capabilities into its security portfolio.

Veza’s Next-Gen IGA module automates provisioning, deprovisioning, and access reviews based on effective permissions, translating system permissions into create, read, update, and delete terms. Audit-ready reports cover frameworks including SOX, SOC 2 Type II, ISO 27001, PCI DSS, GDPR, and HIPAA.

Key features include:

• Effective permissions visibility: Maps the identity ecosystem across apps, data systems, cloud, SaaS, and on-prem to uncover dormant accounts, excessive privileges, access drift, and non-human and third-party access.

• Risk-prioritized access reviews: Campaigns can cover any human or machine user or any resource, such as an S3 bucket or Snowflake table. Risk scoring, policy violations, outliers, usage insights, and past certification decisions are shown to reviewers.

• Review automation and delegation: Assigns reviewers to managers or resource owners automatically, bulk-certifies access based on conditions such as recent usage or SoD, and suggests decisions from past reviews. Event-driven microcertifications and multi-level sign-off are supported.

• Lifecycle management: Anchors joiner, mover, and leaver workflows to HR, payroll, ITSM, and IdP sources, and provisions access across thousands of SCIM-based applications. Dry Run simulation and Safety Limits test changes, and all provisioning events are logged.

• Just-in-time access requests: Users can view, request, and remove their own access, including time-bound privileged access, without opening tickets.

• Separation of duties detection: Identifies toxic combinations and SoD violations within applications and across platforms.

• Integration framework: Provides 325+ native integrations, SCIM provisioning, the OAA framework for custom and legacy applications, and CSV flat-file support.

Limitations (based on publicly available sources):

• Cost and setup complexity: A user review on PeerSpot describes pricing as high and setup as complex, especially for smaller projects.

• Platform transition: Following the ServiceNow acquisition, organizations using Veza alongside other IGA tools may need to review licensing and roadmap changes at renewal.

• Newer IGA workflows: Industry analysis notes that lifecycle and IGA workflows were added more recently than the core access graph, so production readiness should be validated for specific use cases.

Source: Veza

3. Lumos

Best for: Mid-market teams automating access reviews and JML workflows

Strengths: Agentic access reviews, app store requests, role mining

Things to consider: Custom app integrations can take extra setup time

Lumos is an autonomous identity platform that uses AI agents, powered by its Albus AI core, to run identity governance work for humans, non-human identities, and AI agents. It combines access reviews, lifecycle management, just-in-time access, role mining, NHI governance, and MCP governance in one platform with 300+ integrations.

For compliance programs, Lumos agents scope access review campaigns, certify clear-cut access, set aside ambiguous items for human decisions, and assemble auditor-ready evidence. Policies can be drafted as RBAC or ABAC from HRIS, IdP, application, and usage data, with SoD checks and closed-loop enforcement.

Key features include:

• Agentic user access reviews: Runs human and NHI reviews in the same campaign, drafts explainable decisions, enforces remediation automatically, and exports evidence for auditors.

• Role mining: Learns how teams actually use access and proposes roles that remove unused entitlements, then keeps the role model current as the organization changes.

• JML lifecycle automation: Lifecycle events flow from the HRIS so joiners get access on day one, movers do not accumulate excess access, and leavers are offboarded with licenses reclaimed. Service accounts and agent connections owned by departing employees are surfaced for review.

• Just-in-time access: Humans and AI agents request access in Slack, the IT system, or through MCP. Access is granted against policy and revoked on schedule.

• Entitlement translation: Translates technical permissions into plain English so approvers understand what an entitlement grants before approving it.

• NHI and agent ownership: Discovers service accounts, keys, tokens, and agents, assigns human owners, decommissions dormant identities, and right-sizes overscoped access.

• MCP governance: Discovers MCP servers across the organization, catalogs the tools and data they expose, and flags unapproved connections.

Limitations (as reported by users on G2):

• Integration coverage gaps: Not all applications are fully supported, and some apps have no available API integration for the access reviews module.

• Custom app setup time: Integrating custom or lesser-known applications can take longer than expected.

• Integration errors: Some users report bugs when integrations fail and find integration setup complicated.

Source: Lumos

4. C1.ai (formerly ConductorOne)

Best for: Cloud-first teams automating UARs, JML, and JIT access

Strengths: Automated reviews, SoD detection, extensible connectors

Things to consider: Pending Workday acquisition; some integration gaps

C1.ai, formerly ConductorOne, is an identity platform that governs lifecycle, access requests, access reviews, and compliance for people, non-human identities, and AI agents. Its C1 Identity Governance module covers lifecycle, access, reviews, compliance, and remediation, while C1 Connectors and C1 Bridge link it to cloud, on-prem, legacy, and custom systems.

Workday announced a definitive agreement to acquire C1.ai in October 2026. The platform runs review campaigns for scopes such as finance entitlements, production infrastructure admins, privileged database access, and service account owners, and an AI assistant reports which campaigns are behind schedule.

Key features include:

• Automated compliance reviews: Runs user access reviews and separation-of-duties conflict detection, with campaign tracking for due dates, progress, and open reviewer tasks.

• HR-driven onboarding: Turns HR and directory events into day-one account and access changes across supported systems.

• Birthright and policy-based provisioning: Provisions access based on conditions and policy, and routes requests to any connected system.

• Self-service access: Gives people and agents self-service access to approved applications and AI tools, with policy applied before fulfillment.

• Application onboarding and extensibility: Connects cloud, on-prem, legacy, and custom applications. Teams can extend the platform with APIs, custom functions, a CLI, webhooks, and an AI integration builder, and manage it as infrastructure with Terraform.

• NHI and identity security: Discovers, alerts on, and remediates identity risks in real time across the workforce and agents.

• Agent runtime governance: Gives agents policy-controlled access to models, tools, and credentials at runtime, with human approval for sensitive changes.

Limitations (as reported by users on G2):

• Integration library coverage: The available integrations may not cover an organization’s full tech stack, with some connectors built on request.

• Service integrations: Some users would like better integration with certain services.

• Review actions: Users would like to modify access levels directly within a review, instead of only removing access from the profile or resource.

Source: C1.ai

Enterprise and Identity Provider-Based IGA Suites

5. SailPoint Human Fabric (formerly Identity Security Cloud)

Best for: Large enterprises running complex, multi-system governance programs

Strengths: AI-driven certifications, SoD enforcement, JIT access, audit reports

Things to consider: Implementation cost and learning curve can be significant

SailPoint Human Fabric is the cloud-native evolution of SailPoint Identity Security Cloud, built on the SailPoint Atlas platform. It is organized around three areas: Discover for visibility into identities and access paths, Govern for policy-enabled requests, AI-driven certifications, and SoD enforcement, and Protect for just-in-time access and drift detection.

Human Fabric is sold within SailPoint Identity Security suites, which also include SailPoint Agentic Fabric for AI agents. Its Compliance Management module enforces access policies, collects audit evidence automatically, and generates audit-ready reports on demand.

Key features include:

• Identity graph and posture visibility: Traces who has access to what and why across the environment, and surfaces dormant accounts, excess privileges, and drift in real time.

• AI-driven certifications: Auto-certifies low-risk access and flags high-risk anomalies for review. Technical entitlements are translated into plain-language descriptions, and usage telemetry shows stale, unused access.

• Separation of duties enforcement: Applies SoD policies to access requests and blocks toxic combinations before they are granted.

• Just-in-time access: Grants elevated access only for the time a task requires, evaluates context, policy, and risk at request time, and re-checks active sessions.

• Automated lifecycle provisioning: Provisions, adjusts, and corrects access as roles, teams, and attributes change across joiner, mover, and leaver events.

• Access Modeling and Identity Outliers: Recommends roles based on peer group comparisons and identifies abnormal access patterns.

• SOC integration and response: Monitors identity behavior, closes sessions and revokes access when anomalies appear, and feeds identity context to SOC workflows.

• Advanced capabilities: Add-ons include Non-Employee Risk Management, Access Risk Management, Cloud Infrastructure Entitlement Management, and Password Management.

Limitations (as reported by users on G2):

• Support responsiveness: Some users report delays in resolving support issues and turning to professional services instead.

• Total cost of ownership: Beyond licensing, users cite costs for implementation, specialized consulting, and ongoing maintenance.

• Customization limits: Custom code and rules require paid services, and many policies have upper limits.

• Learning curve: Users describe complexity in learning and implementing the platform, and the number of options can be overwhelming at first.

Source: SailPoint

6. Saviynt Identity Governance and Administration

Best for: Enterprises converging IGA, PAM, and app access governance

Strengths: AI recommendations, SaviAI assistants, cloud and ERP coverage

Things to consider: Setup and campaign UX can be complex for new admins

Saviynt Identity Governance & Administration is part of the cloud-native Saviynt Identity Platform, which also includes Application Access Governance, Privileged Access Management, Identity Security Posture Management, and Zuma for AI identities. It governs internal, external, human, non-human, and AI agent identities.

Saviynt connects to SaaS, hybrid, on-prem, IaaS, ERP, EMR, CRM, and HR systems and automates the identity lifecycle from onboarding to departure. It brings identity data, security controls, and compliance processes into one platform for policy enforcement and audit reporting.

Key features include:

• Intelligent recommendations: Uses AI-powered recommendations and guidance for access requests and reviews, and can automate up to 75% of access review decisions.

• Certification campaigns: Focuses approvers on the most critical access to reduce review fatigue and rubber-stamping.

• Access control policies: Supports role-based, resource-based, and attribute-based policies, with detection of high-risk requests and policy enforcement.

• Auditing and reporting: Provides auditing and reporting workflows for continuous compliance documentation and tracing access decisions.

• SaviAI assistants: Includes a User Assistant for natural-language access requests, an Integration and Onboarding Assistant for app connections, a SOC Assistant for identity threat triage, and an Admin Assistant for configuration and lifecycle changes.

• Cross-application SoD and ERP governance: Supports cross-application separation of duties and ERP use cases, including SAP.

• Ecosystem integrations: Offers pre-built integrations, including AWS, SAP, ServiceNow, CrowdStrike, Wiz, and Zscaler, and connects to SIEM tools for monitoring.

Limitations (as reported by users on G2):

• Learning curve and interface: Users find the UX and forms confusing, and some describe the campaign module as not user-friendly.

• Implementation effort: Setup and implementation can be complex and time-consuming.

• Custom integrations: Support for custom integrations is limited, and some connectors, such as the ServiceNow connector, are difficult to configure.

• Customization options: Users report limited customization and default dashboards that are not set up out of the box.

Source: Saviynt

7. Okta Identity Governance

Best for: Organizations already using Okta as their primary identity provider

Strengths: Unified IAM and governance, 600+ integrations, plain-language UI

Things to consider: Less suited to highly complex certification scenarios

Okta Identity Governance (OIG) adds access requests, access certifications, entitlement management, and reporting to the Okta platform, alongside Okta access management. It uses more than 600 native integrations to discover users and permissions across the application stack.

For audits, managers receive scheduled certification campaigns to review their team’s permissions, and the platform keeps an auditable record of approvals. Entitlements are managed in the unified user profile, so permissions in downstream apps are updated or revoked when an employee’s role changes.

Key features include:

• Access certifications: Schedules periodic certification campaigns and notifies managers to confirm or remove team members’ permissions, producing documented evidence for auditors.

• Self-service access requests: Employees request applications or privileged groups through a self-service portal or Slack and Teams. Requests route automatically to the right approver.

• Entitlement management: Controls fine-grained permissions within applications, such as admin versus viewer roles in Salesforce, as part of the user profile.

• Governance Analyzer: Uses unified risk signals to provide recommendations for access decisions.

• Queryable reporting: Offers a single source of truth with queryable reports across identity use cases.

• Workflow orchestration: Orchestrates identity processes, such as identifying inactive app users, and integrates with Okta Workflows for no-code automation.

• Lifecycle and privileged access: Works with Okta Lifecycle Management for automated onboarding and offboarding and with Okta Privileged Access for privileged accounts.

Limitations (as reported by users on Gartner Peer Insights):

• Complex certifications: Certifications with multiple conditions across multiple identity sources can be difficult to configure.

• Control granularity: Governance controls tend to be broad, and specific requirements may need custom code.

• Workflow customization: Workflow flexibility is limited, and custom code may need maintenance after vendor upgrades.

Source: Okta

8. Microsoft Entra ID Governance

Best for: Microsoft-centric organizations governing Entra ID and Microsoft 365

Strengths: Lifecycle workflows, access packages, access reviews, PIM

Things to consider: Integration with non-Microsoft and database apps varies

Microsoft Entra ID Governance adds identity governance to Microsoft Entra ID, covering entitlement management, lifecycle workflows, access reviews, and Privileged Identity Management. It supports cloud and on-premises applications and integrates Microsoft apps with hundreds of non-Microsoft apps.

The product automates access for employees, suppliers, and business partners, sets requirements for recurring access reviews, and prevents conflicting access through separation of duties. It is also included in the Microsoft Entra Suite alongside Conditional Access and network access capabilities.

Key features include:

• Entitlement management: Automates access request workflows, assignments, reviews, and expiration through access packages, with access decisions delegated to business groups.

• Lifecycle workflows: Creates identities automatically from HR system signals and removes access when employees leave the organization.

• AI-driven and standard access reviews: Supports recurring reviews of users, group memberships, and app access, with self-assessment or assigned reviewers and machine learning-based insights.

• Privileged Identity Management: Provides time-based and approval-based role activation for users and groups to reduce standing privileged access.

• Separation of duties: Prevents conflicting access assignments, such as holding both app administrator and app user access.

• Guest and partner governance: Applies the same entitlement management and access review controls to guests, suppliers, and partners, with exception handling and reporting.

• Group-based access assignment: Assigns app and resource access automatically based on employee group memberships.

Limitations (as reported by users on PeerSpot):

• Review performance at scale: Access reviews for large groups can be slow.

• Integration gaps: Database-based applications and some third-party tools are not fully integrated.

• Scheduling and portal issues: Scheduling features need refinement, and some bugs require workarounds when running tasks from the portal.

Source: Microsoft

Conclusion

Selecting the right IGA platform is essential for establishing strong access governance and meeting compliance standards. By automating access reviews, lifecycle management, and least-privilege enforcement, organizations can continuously protect sensitive systems. An effective solution simplifies audit processes while reducing administrative overhead across human and non-human identities.